Security Engineer: Red/Blue Team & AppSec Expert

Convene; Cebu City; Sur place; PHP 600 000 - 900 000; Plein temps

Résumé du poste

Convene in Cebu City is seeking a Security Engineer to lead penetration testing of web and mobile apps and own the vulnerability lifecycle from discovery to remediation. You will monitor security risks and conduct investigations, liaising with users on security inquiries during Pre-sales and Support.

You will collaborate with engineering and DevOps to implement security best practices, automate detection in the software development lifecycle, review components, assist with threat modeling, and

Qualifications

• Minimum 5 years in application security testing/assessments.
• Solid understanding of cybersecurity principles and standards like OWASP Top 10 and SANS Controls.
• Experience with the tools listed (Burp Suite, ZAP, Metasploit, SonarQube).
• Experience with Java, JavaScript, C/C++.
• Knowledge of AWS and SIEM technologies.
• Certifications such as CISA/CISM/CISSP are a plus.

Responsabilités

• Perform penetration testing of Web and Mobile applications.
• Own the vulnerability management lifecycle from identification to remediation to reporting.
• Monitor operational security risks and conduct technical investigations.
• Liaise with users on security inquiries during Pre-sales and Support.
• Engage with Blue Team to implement security best practices in development and DevOps.

Connaissances

App security 5+ yrs

OWASP Top 10

SANS Critical Controls

Java/JS/C/C++

Bash/PowerShell

AWS

SIEM

Blue/Red team

Outils

Burp Suite

OWASP ZAP

Metasploit

SonarQube

Ghidra/IDA (plus)

Description du poste

Convene in Cebu City is seeking a Security Engineer to lead penetration testing of web and mobile apps and own the vulnerability lifecycle from discovery to remediation. You will monitor security risks and conduct investigations, liaising with users on security inquiries during Pre-sales and Support.

You will collaborate with engineering and DevOps to implement security best practices, automate detection in the software development lifecycle, review components, assist with threat modeling, and